ค้นหาเนื้อหา
ไม่เปิดเผย
พอดีไป ค้นหาแล้วเจอ บทความการแกะแพคเกต WMO ครับ
ซึ่งเนื้อหา แนะนำขั้นตอนการแกะ Hash (น่าจะเป็นตัวเข้ารหัส หรืออะไรทำนองนั้น)
ซึ่งในบทความ กล่าวถึง Xtrap NProtect ไม่แน่ใจว่าเกี่ยวอะไรกัน
คราวนี้ จากตัวอย่างครับ โค้ด เป็น ภาษา C รบกวนผู้รู้ แปลงเป็น ภาษาเดลไฟให้ด้วยครับ
อ้างอิง ::
http://reversing.us/...ket Hacking.htm
CODE
Packet Hacking (Reversing HASH 1 in Water Margin)
Part 1
g3nuin3 & hunter
Welcome to this hopefully not too long paper covering packet deciphering and
emulating raw packets. This series is going to cover how I and hunter hacked water margin and worked on deciphering the packets, this paper will only covers reversing hash one for the sent packet data. We won’t reveal every bit of it, but hopefully cover enough. This tutorial assumes a bit of assembly knowledge and knowing how to debug and understanding some debugging terms will help as well..
Many MMO’s nowadays are taking drastic measures to protect their game, their databases and to protect their players.. I for one am not against this and I’m not the type of person to fuck their games up out of pure evil.. its for knowledge and practice..and fun…With that said, what you do with the information revealed in this article is not my responsibility..
When embarking on a mission to decipher a games packets there are few things to expect.. For one, failure.. and lots of it…Second.. time.. and LOTS of it..and skill…lots of it would be nice. Understanding assembly is a must. Because depending on how tough the game encrypts its data.. you will be tracing quite a bit of code.
Now, there’s no one way to find out how a games packets are to be deciphered, so please don’t take this article and try to use the same techniques for all other games. You probably won’t get far. There are many obstacles that may get in the way, such as anti-hack protections that use their own encryptions on the games protocol (XTrap, Hackshield, Nprotect), and in some cases where an attack on the server is the only way to manipulate the games important data…
Water Margin in this case takes none of those into consideration..just simple protocol encryption between client and server using crc32 tables and hashes.
I’m sure by now you’ve heard of a tool called WPE Pro. It’s a middle man program which injects a dll into a preferred process and attempts to hook some known winsock functions, the hook simply transfers any raw packet data used by the send/WSASend/recv/WSArecv API’s and puts it into a nice little format for us to use.. we can then do what we please with the data, edit it, send it back.. modify incoming data and edit them on the fly.. Now you may think this is effective. But in our case.. not much, Only when a game uses no kind of encryption is wpe totally useful, When working with encrypted data, it can only help us identify that the game uses encryption. Now, how do we know if we’re working with encrypted packets ( I will be referring to packets that expire or timestamped as well as other terms as ‘encrypted’ for simplicity)?
If you have Water Margin, open it up and target it with WPE Pro. The easiest but not best way to work with packets is by seeing what you get from the chat packets.(Although some games don’t encrypt their chat packets, it’s a great starting point to trace code from) Understand that packets are only just hex data being sent to the server from the client. In WPE I like to filter the options for the current data Im analyzing.. for now we want to log the sent packets so in wpe go to VIEW -> Option.. Under Winsock 1.1 tick only Send. And under Winsock 2.0 tick WSASend, the buffer size can remain where it is.. mine is at 5000.( we will probably never log that much at once.)
